🇬🇧
Aetherweb Ark
2026-11-14 04:13:57
UTC ·
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 84.233.212.43 (US/United States/unn-84-233-212-43.datapacket.com): N in the last X secs
Web App Attack
🇿🇦
Megasurf
2026-11-14 03:38:07
UTC ·
(1 day ago)
web application attack (blocked by the web application firewall). Blocked automatically by our firewall (LF_MODSEC).
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 03:34:51
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 84.233.212.43 (unn-84-233-212-43.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:34:44.644134 2026] [security2:error] [pid 17755:tid 17755] ...
show more
(mod_security) mod_security (id:210492) triggered by 84.233.212.43 (unn-84-233-212-43.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:34:44.644134 2026] [security2:error] [pid 17755:tid 17755] [client 84.233.212.43:54327] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "megastorebuilders.info"] [uri "/.env"] [unique_id "avfW1AX8cHfAwvHA5A6ELwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-14 03:26:55
UTC ·
(1 day ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 14:33:16
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 84.233.212.43 (unn-84-233-212-43.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:33:13.243653 2026] [security2:error] [pid 8798:tid 8798] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 84.233.212.43 (unn-84-233-212-43.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:33:13.243653 2026] [security2:error] [pid 8798:tid 8798] [client 84.233.212.43:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.kimbrothersusa.com"] [uri "/.env/.env.bak"] [unique_id "avMrKXNpFiC8kVTY8m8jxAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-11-10 14:32:31
UTC ·
(4 days ago)
(secretscan) Secret-Scanner (env/git/ssh/credentials) from 84.233.212.43 (US/United States/unn-84-233-212-43.datapacket.com)
Hacking
🇦🇺
2000cn.com.au
2026-11-10 14:22:48
UTC ·
(4 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-10 14:14:54
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 84.233.212.43 (unn-84-233-212-43.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:14:48.526697 2026] [security2:error] [pid 13830:tid 13830] ...
show more
(mod_security) mod_security (id:210492) triggered by 84.233.212.43 (unn-84-233-212-43.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:14:48.526697 2026] [security2:error] [pid 13830:tid 13830] [client 84.233.212.43:53519] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.hvacs-aircon.com"] [uri "/.env/.env.bak"] [unique_id "avMm2EmXu7amvAxdV6FzlgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-11-10 14:05:08
UTC ·
(4 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇹🇷
Jova
2026-11-10 14:00:05
UTC ·
(4 days ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 13:59:40
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 84.233.212.43 (unn-84-233-212-43.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:59:33.891161 2026] [security2:error] [pid 2505:tid 2505] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 84.233.212.43 (unn-84-233-212-43.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:59:33.891161 2026] [security2:error] [pid 2505:tid 2505] [client 84.233.212.43:53785] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.globalpackets.net"] [uri "/.env/.env.bak"] [unique_id "avMjRaYmiKSyqoDeEXRrawAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
stinpriza
2026-11-10 13:50:38
UTC ·
(4 days ago)
Web App Attack
Web App Attack
🇳🇱
Site.eu
2026-11-07 02:18:49
UTC ·
(1 week ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
2026-11-07 01:52:09
UTC ·
(1 week ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇫🇷
mail.avx.gr
2026-11-07 01:35:57
UTC ·
(1 week ago)
plesk-rapid-ban env-second-probe host=thalassa.paladin.gr
Hacking
